More frequently, customers are turning to the convenience of websites for accessing and managing financial account information and to engage in e-commerce and other online transactions. Consequently, Internet users face a growing threat from online fraud. Identity thieves take advantage of the anonymity of the Internet, its relative insecurity as compared to bricks and mortar outlets, and its ability to provide programmatic access to any information. Nevertheless, consumers remain enamored by the ease of use of Internet banking and e-commerce sites (Morgan Stanley estimates 61% of US population is online—181 million users) but do not do enough to protect themselves. For example, according to information obtained by RSA Security and Network Intelligence, 81% of people surveyed thought identity theft was a critical issue, but less that 46% were motivated to change passwords regularly and only 4% made the effort to check credit reports. As noted by the Federal Financial Institutions Examination Council (“FFIEC”), “an effective authentication system is necessary for compliance with requirements to safeguard customer information, to prevent money laundering and terrorist financing, to reduce fraud, to inhibit identity theft, and to promote the legal enforceability of . . . electronic agreements and transactions.” Consequently, online service providers, such as financial institutions (“FI”) and e-commerce merchants, have a need for secure and reliable online authentication solutions utilizing multiple factors (“multifactor”) of authentication.
Current methods of allowing customer access to financial information and electronic funds transfers online provide unsatisfactory levels of security. For example, a typical implementation of online authentication might involve a user, such as an account holder at an FI, selecting or being assigned a username and pass code (single-factor authentication) for access to secure information, such as account records. However, usernames and pass codes may be easily compromised through well-known Internet fraud techniques. According to the FFIEC's recently issued guidelines, stronger, multi-factor forms of authentication are needed. FFIEC agencies “consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties. Financial institutions offering Internet-based products and services to their customers should use effective methods to authenticate the identity of customers using those products and services” (sec Federal Financial Institutions Examination Council, “Authentication in an Internet Banking Environment”, 2005). The FFIEC further makes the following observations:                1. Multi-factor authentication provides much better security than single-factor authentication (username and passcode).        2. Financial institutions should conduct a risk assessment to see whether their existing authentication system is deemed adequate.        3. A successful authentication system “should have customer acceptance, reliable performance, scalability to accommodate growth, and interoperability with existing systems and future plans”.        4. If critical systems are outsourced to third-parties, appropriate monitoring and reporting processes should be in place. Suspicious activities need to be reported by the third-party organization rapidly. The ability for external audits would need to be supported.Similar issues affect the operation and security of e-commerce websites. Most merchant websites currently implement their own identity management systems. While these systems provide a merchant the capability to manage its customer base and provide some level of personalization, the focus of online merchants is rapidly shifting to providing a security barrier against fraudulent access. With merchant websites requiring constant content and structure updates (what is developed today will soon be obsolete), no website is ever “complete” and is continually open to new security exploitations.        
To address these needs, the present disclosure describes a third party-maintained authentication infrastructure whereby online service providers, such as financial institutions and e-commerce merchants utilize a registered biometric device as part of the login process for a registered and trusted user.